Privacy Policy

Last updated: 22 April 2026

About This Policy

Scam.SG is operated by OnScam (SG) Pte. Ltd. ("we", "us", "our"). This Privacy Policy explains how we collect, use, and protect personal data in accordance with Singapore's Personal Data Protection Act 2012 ("PDPA"). By accessing Scam.SG, you acknowledge this policy.

What Data We Collect

We collect personal data in the following circumstances:

  • When you contact us via our contact form — name, email address, message content.
  • When you register an account — name, email address, company name (if applicable).
  • When you submit a scam report or community review — content of the submission. We do not require or store your identity for anonymous submissions.
  • Automatically via your use of the website — IP address, browser type, pages visited, via analytics tools.

This data is collected only with your consent (see Cookies section below).

How We Use Your Data

We use collected data solely for the following purposes:

  • To operate, maintain, and improve the Scam.SG platform
  • To respond to enquiries submitted via the contact form
  • To moderate and publish community submissions in accordance with our editorial standards.
  • To send service communications (not marketing) to registered account holders.

Company Profile Data

Business profile data published on Scam.SG is sourced from publicly available records, including ACRA's open dataset and other publicly accessible regulatory and business intelligence sources. This data relates to business entities, not individuals. Where a sole proprietorship or other entity structure means that business data is also personal data, we publish only information that is in the public domain and that a reasonable person would expect to be publicly accessible.

Cookies

We use essential cookies required for the website to function. We use non-essential cookies (analytics, performance) only with your explicit consent. A cookie consent banner will prompt you on your first visit. You may withdraw consent at any time via the cookie settings link in the footer. Non-essential scripts do not load before you provide consent.

Data Retention

Contact form submissions are retained for 12 months and then deleted. Account data is retained for the duration of the account and deleted within 30 days of account closure on request. Analytics data is retained in aggregate form only — individual-level data is not stored beyond 26 months.

Your Rights Under the PDPA

You have the right to request access to personal data we hold about you, and to request correction of any inaccurate data. To make a request, contact us via the Scam.SG contact form at scam.sg/contact-us. We will respond within 10 business days.

Third-Party Services

We use third-party services including analytics platforms and hosting providers. These services may process your data in accordance with their own privacy policies. We select only services that meet adequate data protection standards.

Contact

For privacy-related enquiries, contact us via the Scam.SG contact form at scam.sg/contact-us, selecting the "Privacy" category.